The420.In

Evasive Panda APT Uses DNS Poisoning to Deploy MgBot Malware in Targeted Attacks

First seen 1 Jan 2026, 08:19 UTC • The420.In

•74% similarity •52.0

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The China-linked APT group Evasive Panda has conducted cyber-espionage campaigns using DNS poisoning to install the MgBot backdoor. Targeted victims include entities in Türkiye, China, and India. Kaspersky researchers have identified this group, also known by several other names, as responsible for these attacks.

ThreatCluster AI

Attack Flow

8 entities, 17 inferred relationships (STIX 2.1).

Threat Actor (4)

Bronze Highland
Daggerfly
Evasive Panda
StormBamboo

Technique (2)

Malware
DNS Poisoning

Campaign (1)

Evasive Panda Cyberespionage Campaign

Malware (1)

MgBot

Relationships

Bronze Highland uses MgBot
Daggerfly uses MgBot
Evasive Panda uses MgBot
StormBamboo uses MgBot
Bronze Highland uses Malware
Bronze Highland uses DNS Poisoning
Daggerfly uses Malware
Daggerfly uses DNS Poisoning
Evasive Panda uses Malware
Evasive Panda uses DNS Poisoning
StormBamboo uses Malware
StormBamboo uses DNS Poisoning
Evasive Panda Cyberespionage Campaign attributed to Bronze Highland
Evasive Panda Cyberespionage Campaign attributed to Daggerfly
Evasive Panda Cyberespionage Campaign attributed to Evasive Panda
Evasive Panda Cyberespionage Campaign attributed to StormBamboo
Evasive Panda Cyberespionage Campaign uses MgBot

Community

Browse all →

Evasive Panda APT Uses DNS Poisoning to Deploy MgBot Malware in Targeted Attacks

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading